Using both is fine. That way if you encounter a client that is using http 1.0 they'll be sure to honor your cache control request. Http 1.1 clients will simply ignore the redundant header so it won't cause any problems. I use both on lots of sites with no ill effects.